Specify and plan M3b: the runner and the tools

A draft spec for the owner's review and 13 offline tasks with their given tests: shared tool arguments and host rules in proto, the sealed fetch target (M3a finding 14), the toolkit tools and SOCKS5 egress proxy, and brokerd's [runner], podman argument lists, runtime and proxy lifecycle. Each task's tests were run against a reference at that task's end state (560 to 638 tests, clippy clean); the reference is not in the repository. Adds the runner-unavailable runbook entry and tip T23 (ETXTBSY in script tests). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-22 22:29:27 -07:00
parent d988edac4a
commit b426ca1958
47 changed files with 4491 additions and 2 deletions
@@ -0,0 +1,116 @@
+//! `is_public`: the egress proxy connects only to public addresses. Every range in the M3b spec,
+//! section 5, has a case at each end, and a public neighbour just outside it. Do not edit.
+
+use std::net::IpAddr;
+
+use toolkit::addr::is_public;
+
+fn ip(s: &str) -> IpAddr {
+    s.parse().unwrap()
+}
+
+#[test]
+fn refused_ipv4() {
+    for s in [
+        "0.0.0.0",
+        "0.255.255.255",
+        "10.0.0.0",
+        "10.255.255.255",
+        "100.64.0.0",
+        "100.100.100.100",
+        "100.127.255.255",
+        "127.0.0.1",
+        "127.255.255.255",
+        "169.254.0.1",
+        "169.254.255.255",
+        "172.16.0.0",
+        "172.31.255.255",
+        "192.0.0.0",
+        "192.0.0.255",
+        "192.0.2.1",
+        "192.168.0.1",
+        "192.168.255.255",
+        "198.18.0.0",
+        "198.19.255.255",
+        "198.51.100.7",
+        "203.0.113.9",
+        "224.0.0.1",
+        "239.255.255.255",
+        "240.0.0.0",
+        "255.255.255.255",
+    ] {
+        assert!(!is_public(ip(s)), "{s} must be refused");
+    }
+}
+
+#[test]
+fn public_ipv4() {
+    for s in [
+        "1.1.1.1",
+        "8.8.8.8",
+        "9.255.255.255",
+        "11.0.0.0",
+        "100.63.255.255",
+        "100.128.0.0",
+        "126.255.255.255",
+        "128.0.0.0",
+        "169.253.255.255",
+        "172.15.255.255",
+        "172.32.0.0",
+        "192.0.1.0",
+        "192.0.3.0",
+        "192.167.255.255",
+        "192.169.0.0",
+        "198.17.255.255",
+        "198.20.0.0",
+        "198.51.99.255",
+        "203.0.112.255",
+        "223.255.255.255",
+        "93.184.216.34",
+    ] {
+        assert!(is_public(ip(s)), "{s} is public");
+    }
+}
+
+#[test]
+fn refused_ipv6() {
+    for s in [
+        "::",
+        "::1",
+        "fc00::1",
+        "fdff:ffff::1",
+        "fd7a:115c:a1e0::1",
+        "fe80::1",
+        "febf::1",
+        "ff02::1",
+        "ff00::",
+        "2001:db8::1",
+        "2001:db8:ffff::1",
+        "::ffff:127.0.0.1",
+        "::ffff:10.1.2.3",
+        "::ffff:100.100.100.100",
+        "64:ff9b::7f00:1",
+        "64:ff9b::a01:203",
+        "::ffff:0.0.0.0",
+        "::127.0.0.1",
+        "::1.1.1.1",
+        "::ffff",
+    ] {
+        assert!(!is_public(ip(s)), "{s} must be refused");
+    }
+}
+
+#[test]
+fn public_ipv6() {
+    for s in [
+        "2606:4700:4700::1111",
+        "2a00:1450::1",
+        "fbff::1",
+        "fec0::1",
+        "2001:db9::1",
+        "::ffff:1.1.1.1",
+        "64:ff9b::101:101",
+    ] {
+        assert!(is_public(ip(s)), "{s} is public");
+    }
+}